Dominik Phillips

Excited to be speaking at @x33fcon 2026 alongside my colleague @thefLinkk. We’ll be presenting “Fingerprinting Modern C2 Implants via Runtime Telemetry” and the tool we built as part of our research. See you there!

@ShitSecure The code that your 'friend' Claude provided is fundamentally flawed and also completely misimplements the concept of nested dynamic code. No need to use AI. Just read the slides.

the callstack scan was inspired by @thefLinkk's github.com/thefLink/Hunt-… (mentioned in the code: #L77" target="_blank" rel="nofollow noopener">github.com/hasherezade/pe…)

Windows kernel data structure - "_HANDLE_TABLE". Every process has one. Whenever you open a file, process, thread, token, event, or mutex, Windows creates a handle entry that maps your user-mode handle to the actual kernel object along with its access rights. This is one of the reasons security researchers spend time understanding it. Handle leaks or overly permissive handles can become powerful primitives for privilege escalation, sandbox escapes, EDR bypasses, and forensic analysis. Sometimes, you don't need to exploit memory corruption, you just need access to the right handle.

📢 #BHEU Call for Briefings is NOW OPEN! Got groundbreaking security research? Share your expertise with the global infosec community! 🔬 Submit your cutting-edge research 🌍 Present at Black Hat Europe 🏆 Join the world's most elite security conference Don't miss this opportunity to showcase your work on the international stage: bit.ly/4veNpve

From Windows driver to custom EDR. A journey through building own EDR-like solution with a historical perspective - a post by Aurélien Chalot (@Defte_). Source: blog.whiteflag.io/blog/from-wind… #redteam #blueteam #maldev #malwaredevelopment

‼️🚨 Unauthenticated attackers are gaining SYSTEM on domain controllers with crafted packets. The vulnerability being exploited is CVE-2026-41089, a CVSS 9.8 hole in Windows Netlogon, and exploitation in the wild has been confirmed. A patch has existed since May 12. Every DC still behind is not just vulnerable, but according to the Centre for Cybersecurity Belgium are also actively being pwnd.

Hyper-V vmms process has embedded EXDI module. It can be used for debugging guest VM attaching to it with oleaut32 bridge from custom EXDI module, even SecureBoot is enabled for guest OS. Limitations of that method are interesting still.

In windows, APCs(Asynchronous procedure calls) is a mechanism in which a function executes in the context of the specific thread. It's not an independent execution entity like a thread. void CALLBACK MyCompletionRoutine(...) { printf("Read completed!\n"); } ReadFileEx(..., MyCompletionRoutine); //Async I/O // Later SleepEx(INFINITE, TRUE); // Alertable wait Here, the completion routine runs even before SleepEx returns. Thread | |-- ReadFileEx() | |-- SleepEx(INFINITE, TRUE) | (alertable wait) | |<-- I/O completes |<-- Windows queues User APC | |-- MyCompletionRoutine() <-- APC executes | |-- SleepEx returns WAIT_IO_COMPLETION | |-- Continue execution That's how the below sequence is possible if you have proper rights to open the process handle to suspend. Btw security software can easily catch this because you're suspending a process and allocating memory etc.

This is best channel for windows Internals by @zodiacon He's one of the authors of the iconic windows Internals books. youtube.com/playlist?list=…

We are releasing tracebit @x33fcon - a POC sensor aiming to fingerprint implants in memory using only lowlevel runtime telemetry. No signatures, no scanning. Only pagefaults. github.com/threathunters-…

"#Fingerprinting Modern #C2 #Implants Through Runtime Telemetry" talk at #x33fcon 2026 by @thefLinkk and @dphillips__ - x33fcon.com/#!/s/Sebastian… #blue, #POC

#Workshop at #x33fcon 2026 - "#Entra ID Takeover: Advanced Techniques for Tenant Compromise and Defense" delivered by Wojciech Lesicki and Marcin Grzesiak - x33fcon.com/#!/w/WojciechL… - #cloud, #Azure, #CTF, #phishing

Microsoft Defender now monitors RPC activity techcommunity.microsoft.com/blog/microsoft…

I've always been interested in Model Specific Registers (MSRs). They're rarely used by application code; they're in the domain of operating systems, hypervisors, firmware, and low-level processor features. My debugger can now selectively access these; but don't crash the system.

An unexpected journey into Microsoft Defender's signature World Blog:- retooling.io/blog/an-unexpe… #windows #defender #reverse

Modern C2 implants use sleep masking & metamorphic code to stay hidden. We’re revealing how to unmask them using low-level runtime telemetry (ETW & CPU profiling) live in production including a POC with a lightweight sensor. My team will be presenting our research at x33fcon: x33fcon.com/#!s/SebastianF…

Someone built a transparent Mario game that runs OVER IDE so can play while waiting for Copilot to write code.

The FLARE Learning Hub is launching with three modules: - Malware Analysis Crash Course - The Go Reverse Engineering Reference - Introduction to Time Travel Debugging (TTD) 📟 Start learning: bit.ly/41x7MXs

MICROSOFT BUILT A TOOL THAT CONVERTS LITERALLY ANYTHING INTO CLEAN MARKDOWN FOR YOUR LLM pdfs. word docs. excel. powerpoint. audio. youtube urls one pip install and your AI pipeline stops choking on raw files forever no custom parsers. no broken layouts. no garbled text. just clean, structured markdown your LLM can actually read github.com/microsoft/mark…